Overview
The U.S. Department of Justice announced the disruption of two hacking platforms, QScan and QTRouter, operated by the China-linked threat group QTFY.
QTFY has been associated with Nanjing Xinjiuwei Network Technology Company, a China-based cyber-enabling organization reportedly maintaining relationships with Chinese government and military customers.
The FBI stated that QTFY-affiliated activity targeted U.S. critical infrastructure and sensitive organizations, with identified victims including NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate.
Security researchers at Lumen Black Lotus Labs have tracked the activity for approximately 18 months and reported that the underlying operation has been active since at least May 2018.
QScan and QTRouter Infrastructure
QScan was used as an automated scanning and exploitation platform. It identified vulnerable internet-facing systems and IoT devices and could compromise vulnerable devices before incorporating them into the QTRouter network.
QTRouter operated as a traffic-obfuscation infrastructure. It combined:
- Compromised IoT devices
- Routers running customized OpenWrt software
- Commercial proxy services
- Leased VPS infrastructure
- Multiple relay nodes
- Chained proxy connections
This architecture allowed QTFY operators to route malicious traffic through geographically distributed systems, making activity appear to originate from locations close to the targeted organization rather than from infrastructure controlled by the threat actors in China.
The FBI described QTRouter as a mechanism that allowed Chinese cyber actors to blend malicious traffic with legitimate users and make traditional IP-based detection significantly more difficult.
Attack Infrastructure
QScan was associated with multiple domains used to coordinate scanning activity and collect results, including:
qt-proxy[.]orgmq-task.qt-proxy[.]orgmq-result.qt-proxy[.]org
QTRouter administration infrastructure included:
www[.]qtproxy[.]xyzsecurelink[.]qtproxy[.]xyz
The platform reportedly used Clash to establish proxy connections and support node selection and multi-hop proxy chaining.
The broader infrastructure included:
Fast Labyrinth
Fast Labyrinth provided an operational relay layer incorporating commercial proxy infrastructure and QTRouter nodes into an encrypted relay network.
QTProxy
QTProxy managed Fast Labyrinth operational nodes and allowed operators to use preconfigured relay paths or create customized routes toward targeted organizations.
QTBotnet
QTBotnet provided command-and-control capabilities for compromised devices. Its architecture included a primary controller, secondary control servers, and compromised endpoints.
The infrastructure could also be used to execute commands on compromised nodes and launch DDoS attacks.
Attack Chain
The observed attack lifecycle can be summarized as:
1. Reconnaissance
QScan performed automated scanning against internet-facing systems, IoT infrastructure, and potential victim networks.
2. Exploitation
QTFY exploited known and zero-day vulnerabilities in internet-facing technologies to obtain initial access.
Examples included vulnerabilities affecting:
- Ivanti CSA
- Fortinet SSL-VPN
- Citrix ADC
- Microsoft Exchange Server
- F5 BIG-IP
- Kentico CMS
- Apache Log4j
- Atlassian Confluence
- Check Point Quantum Gateway
- CrushFTP
- BeyondTrust Remote Support
3. Persistence
The attackers used remote access trojans, web shells, and legitimate credentials to maintain access to compromised environments.
4. Traffic Obfuscation
QTRouter redirected attacker traffic through compromised IoT devices, commercial proxy services, and leased VPS infrastructure.
5. Lateral/Operational Activity
The distributed infrastructure allowed operators to communicate with compromised systems while concealing the originating infrastructure.
6. Data Theft and Further Operations
Once inside targeted environments, QTFY-affiliated actors could conduct further intrusion activity and access sensitive information.
Why QTRouter Is Significant
The QTRouter architecture represents a shift from traditional attacker-controlled infrastructure toward distributed operational relay networks.
Rather than relying on a small number of fixed command-and-control IP addresses, QTFY could use hundreds or potentially thousands of intermediary nodes.
This creates several challenges for defenders:
- IP reputation becomes less reliable.
- Geographic blocking can be bypassed.
- Malicious traffic can originate from apparently legitimate locations.
- Commercial proxy services can hide attacker infrastructure.
- Compromised IoT devices provide constantly changing exit points.
- Static IOC blocking becomes less effective.
- Multi-hop routing increases investigation complexity.
The infrastructure resembles an Operational Relay Box (ORB) architecture, where compromised and rented infrastructure is combined to create a distributed mesh for concealing cyber operations.
Impact on Defenders
Organizations should not rely solely on IP-based blocking to detect this type of activity.
Security teams should prioritize:
- Detection of unusual outbound proxy connections
- Monitoring for unexpected traffic from network appliances
- Identification of unauthorized OpenWrt or router modifications
- Detection of abnormal administrative activity
- Monitoring internet-facing appliances for exploitation attempts
- Rapid patching of known exploited vulnerabilities
- Detection of web shells and unauthorized remote-access tools
- Monitoring for unusual authentication patterns
- Correlation of network telemetry with threat intelligence
- Behavioral detection of multi-hop proxy activity
Organizations operating critical infrastructure should also continuously inventory internet-facing assets and prioritize remediation of vulnerabilities known to be actively exploited.
Threat Intelligence Assessment
QTFY demonstrates how China-linked cyber operations are increasingly adopting industrialized infrastructure models.
The combination of automated scanning, compromised IoT devices, commercial proxy services, leased VPS infrastructure, and multi-hop relay networks provides threat actors with scalable infrastructure for espionage and intrusion operations.
The use of legitimate commercial services also reduces the effectiveness of traditional static blocklists.
For defenders, the key takeaway is that infrastructure-based detection must increasingly be complemented by behavioral, identity, endpoint, and network analytics.
Indicators of Compromise
Domains
qt-proxy[.]orgmq-task.qt-proxy[.]orgmq-result.qt-proxy[.]orgqt-team[.]commq-task.qt-team[.]commq-result.qt-team[.]comwww[.]qtproxy[.]xyzsecurelink[.]qtproxy[.]xyzfastlink[.]ws
Infrastructure / Malware
- QScan
- QTRouter
- QTBotnet
- QTProxy
- Fast Labyrinth
- Clash proxy infrastructure
Referenced CVEs
- CVE-2024-8190
- CVE-2024-8963
- CVE-2024-9380
- CVE-2018-13379
- CVE-2019-19781
- CVE-2021-26855
- CVE-2020-5902
- CVE-2019-10068
- CVE-2021-44228
- CVE-2023-22515
- CVE-2024-24919
- CVE-2025-31161
- CVE-2026-1731